Imagine every person on the internet publishing one self-owned profile - privacy preferences first, then needs, wants, and all their favorite things - that any website, app, or brand can subscribe to with granular read access. Granted by you, receipted for you, revocable by you. This page is the draft standard, published while we build it.
Every website, app, and brand assembles its own profile of you - collected behind your back, stale the moment it's built, breached on someone else's watch. You are reconstructed a thousand times and own none of the copies.
You keep one profile, on hardware you own. Anyone who wants to know your preferences subscribes to exactly the fields you allow - scoped, dated, receipted, revocable. The direction of subscription reverses, and so does the ownership.
Preferences stop being something extracted from you and become something you grant - free where you choose, priced where you choose, and withdrawn the moment you say so. Value flows to the owner of the asset: you.
Privacy preferences are the one stream with legally mandated demand on every website on earth - it is what the cookie banner pretends to collect, a thousand times over, badly.
One grant to your published privacy preferences replaces every banner: sites read your current, provable consent state instead of interrupting you. Compliance for them; silence for you.
The same rail then carries what you choose to publish next: sizes and delivery windows, the things you are in the market for, and the brands, artists, and people you love - each its own scope, each on your terms.
Scopes are dot-paths from a small set of roots. A subscriber asks for scopes; a grant is always field-level. Simple enough to read aloud, precise enough for an agent.
scope := root "." path ; lowercase, dot-separated
root := "privacy" | "prefs" | "wants" | "favorites"
privacy.marketing-email ; may you email me marketing?
privacy.analytics ; may you measure my visit?
prefs.apparel.shoe-size ; one field, nothing more
wants.home-services.plumber ; what I'm in the market for
favorites.artists ; the people whose work I love
grant := { subscriber, scopes[], purpose, ttl, price? }
read := granted fields at current values + signed receipt
revoke := one tap; propagates to the subscriber, fabric-wideA subscriber (a site, an app, a brand's agent) asks for named scopes with a purpose, a TTL, and terms. The request is machine-readable and arrives through your 🤫 Agent - never a popup.
You approve per scope, per subscriber - one tap, biometric-unlocked, with the expiry you choose. Silence means no. Nothing defaults open.
Every read returns only the granted fields at that moment's values, and writes a signed receipt to your ledger. Fresh data for them, a perfect audit trail for you.
Grants expire on their TTL or the instant you revoke - one tap, fabric-wide, propagated to the subscriber like an unsubscribe they cannot ignore.
A subscription request, on the wire. Any agent that speaks MCP or A2A can carry it; PCHP wraps every read in consent and a receipt.
{
"pchp": "rfc-002-draft",
"type": "subscription_request",
"subscriber": "brand.example",
"scopes": ["privacy.marketing-email", "prefs.apparel.shoe-size"],
"purpose": "Serve you in your size and only email you if you say yes.",
"ttl_days": 365,
"terms": { "retention": "none", "price": "free" }
}pchp.js is the reference embed, live now: paste one script tag and your site asks once, beautifully - and never again on that device. Previously-answered visitors sail through in silence while your page receives their current choices instantly. Works on any website, any app with a webview, any Shopify theme.
<script src="https://hushh.ai/pchp.js"
data-subscriber="your-brand.com"
data-scopes="privacy.marketing-email,privacy.analytics"
data-endpoint="https://your-site.com/api/pchp"></script>
<script>
addEventListener("pchp:consent", (e) => {
// e.detail.scopes -> { "privacy.marketing-email": true, ... }
// fires instantly on every visit once the person has answered
});
</script>The optional data-endpoint POSTs each grant and revoke to your own backend as JSON - any endpoint, any stack. v0 stores the grant on the person's device with a local receipt; account-level sync through their own 🤫 Agent One is the roadmap, and this API will not change. Try it live on the demo page.
What exists today: PCHP (RFC-001), the consent receipt, the open agent rails 🤫 One already speaks, and pchp.js - the reference embed above, live and embeddable now, with device-local grants and receipts. What remains in design: account-level sync through the person's own Agent, server-side receipts, the subscriber API, and payments on streams. We publish the draft before it fully ships because we build in the open; when each piece goes live, this page will say so plainly.
A draft open standard (RFC-002) on PCHP rails that inverts how the internet learns your preferences: instead of every company assembling its own copy of you, you publish consent-gated preference streams - privacy choices first, then wants and favorites - and subscribers hold granular, revocable, receipt-logged read access to exactly the fields you grant.
No - and we say so plainly. PCHP (RFC-001), the consent receipt, and the agent rails exist today; the subscription fabric - the scope grammar, the subscriber API, and the grant/revoke experience - is in design, published here as a draft so the world can read it, challenge it, and build it with us.
A banner collects a one-time answer for one site and stores it on their side; a browser signal is a single global bit. A subscription is a living relationship to your current preferences: field-level scopes, purpose and expiry on every grant, a receipt for every read, and revocation that propagates. It replaces the question instead of repeating it.
Honesty first: no protocol can make a party forget a field it was shown. What the fabric changes is the incentive and the evidence - subscribers get fresher data by staying subscribed than by hoarding stale copies, every read is receipted so misuse is provable, and terms of grant make retention a violation you can act on. Data minimization by construction, accountability by receipt.
Read the consent layer it stands on, tell us where the draft is wrong, or claim your One - the agent that will hold your side of every subscription.
One is a product of Hushh Technologies Corporation (brand: 🤫 “hussh”), an independent company. One runs on third-party silicon, systems, and cloud; all company names are used solely to describe the platforms on which One software runs. Hushh Technologies is not affiliated with, endorsed by, sponsored by, or partnered with any company named.